An attacker targets the city's CI/CD system that builds and deploys the citizen services portal. Which pipeline protections should the security architect prioritize?

The CI/CD pipeline that builds and deploys a citizen services portal is a high-value target because compromise can inject malicious code with legitimate signatures and push it to production at scale. Priority protections include safeguarding pipeline secrets (tokens, signing keys, cloud credentials), verifying artifact integrity through signing and attestation, and enforcing deployment gates so only reviewed, policy-compliant builds reach civic environments. Hardening the assembly line prevents attackers from riding the same trusted path residents rely on.

Publishing all pipeline YAML to an anonymous paste site for peer review exposes infrastructure-as-code, secret references, and environment topology to the world. Peer review belongs inside controlled repositories with access control—not anonymous public dumps that aid reconnaissance.

Disabling code signing so hotfixes ship without friction removes a primary integrity control. Unsigned artifacts make it harder to distinguish legitimate emergency fixes from attacker-planted packages; speed must not erase provenance.

Allowing every contractor to push directly to the production runner collapses least privilege and change control. Broad push rights turn a single compromised account into a direct path to production runners and secrets.

Exam caveat: pipeline security is application security; CISSP expects secrets management, signed artifacts, and gated promotion—not unprotected automation convenience. Operational check: rotate and vault CI secrets, require signed builds, separate build from deploy identities, enforce protected environments with approvals, and alert on anomalous pipeline job or runner behavior for municipal portals.